Nginx应用场景详解与配置指南

news2025/5/18 10:24:37

1. 什么是Nginx？

Nginx（发音为"engine-x"）是一个高性能的HTTP和反向代理服务器，也是一个IMAP/POP3/SMTP代理服务器。它以高性能、稳定性、丰富的功能集、简单的配置和低资源消耗而闻名。

2. Nginx的主要应用场景

2.1 静态资源服务器

Nginx最基础的应用场景是作为静态资源服务器，用于提供静态文件（如HTML、CSS、JavaScript、图片等）的访问。

配置示例：

server {
    listen 80;
    server_name example.com;
    root /var/www/html;
    
    # 开启gzip压缩
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # 缓存设置
    location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }
    
    # 安全设置
    location / {
        try_files $uri $uri/ =404;
        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
    }
}

2.2 反向代理服务器

Nginx作为反向代理服务器，可以将客户端请求转发到后端服务器，实现负载均衡和请求分发。

配置示例：

upstream backend {
    server 192.168.1.10:8080 weight=5;
    server 192.168.1.11:8080 weight=5;
    server 192.168.1.12:8080 backup;  # 备用服务器
}

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 超时设置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}

2.3 负载均衡

Nginx提供了多种负载均衡算法，包括轮询、权重、IP哈希等。

配置示例：

upstream backend {
    # 轮询（默认）
    server 192.168.1.10:8080;
    server 192.168.1.11:8080;
    
    # 权重
    server 192.168.1.12:8080 weight=3;
    server 192.168.1.13:8080 weight=2;
    
    # IP哈希
    ip_hash;
    server 192.168.1.14:8080;
    server 192.168.1.15:8080;
    
    # 最少连接
    least_conn;
    server 192.168.1.16:8080;
    server 192.168.1.17:8080;
}

2.4 SSL/TLS终端

Nginx可以作为SSL/TLS终端，处理HTTPS请求。

配置示例：

server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    
    # SSL配置优化
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # HSTS设置
    add_header Strict-Transport-Security "max-age=63072000" always;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
}

2.5 缓存服务器

Nginx可以作为缓存服务器，提高网站性能。

配置示例：

# 定义缓存区域
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;

server {
    listen 80;
    server_name example.com;
    
    location / {
        proxy_cache my_cache;
        proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
        proxy_cache_valid 200 60m;
        proxy_cache_valid 404 1m;
        
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

2.6 限流控制

Nginx可以实现请求限流，防止服务器过载。

配置示例：

# 定义限流区域
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

server {
    listen 80;
    server_name example.com;
    
    location / {
        limit_req zone=one burst=5 nodelay;
        proxy_pass http://backend;
    }
}

2.7 动静分离

Nginx可以实现静态资源和动态请求的分离。

配置示例：

server {
    listen 80;
    server_name example.com;
    
    # 静态资源
    location /static/ {
        root /var/www/html;
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }
    
    # 动态请求
    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

3. 高级特性

3.1 日志配置

# 访问日志格式定义
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                '$status $body_bytes_sent "$http_referer" '
                '"$http_user_agent" "$http_x_forwarded_for"';

# 错误日志
error_log /var/log/nginx/error.log warn;

# 访问日志
access_log /var/log/nginx/access.log main;

3.2 安全配置

server {
    # 基本安全头
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    
    # 禁止访问隐藏文件
    location ~ /\. {
        deny all;
    }
}